Star Blizzard

Threat Actor
17 incidents First seen 2026-02-07 Last seen 2026-10-31
Overview

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 190 23 techniques 1 tools & malware in ATT&CK since 2024-06-14 updated 2026-07-31 · v2.0
Activity by month (incidents)
2026-022026-10
Sectors targeted
government · 10defense · 3education · 3energy · 2technology · 2aerospace · 1automotive · 1aviation · 1cryptocurrency · 1finance · 1
Countries targeted
RU · 13GB · 10UA · 7US · 7AT · 6CH · 6DE · 6BE · 5CN · 5DK · 5EE · 5FI · 5
Origin
RU · 13UA · 6US · 4CN · 3FR · 3AT · 2
Kinds of incident
State-Sponsored & Espionage · 9Phishing & Social Engineering · 7Malware & Botnets · 4Cyberattack (general) · 2Critical Infrastructure & OT · 1Data Breach · 1
Techniques seen in incidents
Phishing · 15Espionage · 9T1566 - Phishing · 7T1059.006 - Python · 5Exfiltration · 4Reconnaissance · 4Social Engineering · 4T1059.001 - PowerShell · 4Ransomware · 3Spoofing · 3Botnet · 2Impersonation · 2T1059.007 - JavaScript · 2T1218.002 - Control Panel · 2
Related malware
Cyclops Blink · 1Havoc · 1NotPetya · 1ObliqueRAT · 1Pandora · 1PlugX · 1Qilin · 1ShadowPad · 1
Related CVEs
CVE-2017-7921 · 1CVE-2021-35394 · 1CVE-2022-40684 · 1CVE-2023-6895 · 1CVE-2025-21042 · 1CVE-2025-24201 · 1CVE-2025-31200 · 1CVE-2025-33053 · 1CVE-2026-102764 · 1CVE-2026-20079 · 1
ATT&CK techniques by tactic (23)
reconnaissance T1589 Gather Victim Identity Information T1593 Search Open Websites/Domains T1598.002 Spearphishing Attachment T1598.003 Spearphishing Link
resource development T1583 Acquire Infrastructure T1583.001 Domains T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.002 Email Accounts T1588.002 Tool T1608.001 Upload Malware
initial access T1078 Valid Accounts T1566.001 Spearphishing Attachment
execution T1059.007 JavaScript T1204.002 Malicious File
persistence T1078 Valid Accounts
privilege escalation T1078 Valid Accounts
credential access T1539 Steal Web Session Cookie
lateral movement T1550.004 Web Session Cookie
collection T1114.002 Remote Email Collection T1114.003 Email Forwarding Rule
stealth T1078 Valid Accounts T1684.001 Impersonation
Tools & malware it uses
Spica
Incident timeline
2026-10-31
Ransomware Live Bluesky Hackmanac Ransomware Live Check Point Research Dark Reading Ransomware Live
2026-10-28
Adversary Unmasked APT Profile - Star Blizzard
AlienVault OTX
2026-10-22
Talos Intelligence HackRead AlienVault OTX SecurityWeek Dark Reading AlienVault OTX BleepingComputer The Hacker News AlienVault OTX AlienVault OTX AlienVault OTX AlienVault OTX
2026-10-14
Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat
Dark Reading
2026-10-09
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
The Hacker News
2026-10-05
AlienVault OTX HackRead The Hacker News
2026-09-30
BleepingComputer Mastodon BleepingComputer
2026-09-30
AlienVault OTX Dark Reading
2026-09-29
SecurityWeek CyberScoop AlienVault OTX AlienVault OTX
2026-06-27
Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
The Hacker News
2026-06-25
Security Affairs Mandiant
2026-03-30
Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing wave
Security Affairs
2026-03-28
TA446 Deploys DarkSword iOS Exploit Kit in Targeted Spear-Phishing Campaign
The Hacker News
2026-03-23
Rusia intensifica el espionaje digital con ciberataques a WhatsApp y Signal
Bit Life Media
2026-03-21
FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks
The Hacker News
2026-02-23
2025: The Untold Stories of Check Point Research
Zero Day Fans
2026-02-07
German Agencies Warn of Signal Phishing Targeting Politicians, Military, Journalists
The Hacker News